CVE-2025-15177
Stack-Based Buffer Overflow in Tenda WH450 HTTP Handler
Publication date: 2025-12-29
Last updated on: 2025-12-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | wh450 | 1.0.0.18 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Tenda WH450 router firmware version 1.0.0.18, specifically in the HTTP Request Handler component at the /goform/SetIpBind endpoint. It involves a stack-based buffer overflow caused by improper handling of the 'page' argument. An attacker can remotely exploit this flaw to potentially execute arbitrary code or cause a denial of service.
How can this vulnerability impact me? :
The vulnerability can lead to severe impacts including remote code execution, denial of service, and full compromise of the affected device. Since it allows an attacker to overflow the stack remotely, it can result in unauthorized control over the router, potentially affecting network security and availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring HTTP requests to the /goform/SetIpBind endpoint for unusually long or malformed 'page' parameter values that may indicate an attempted exploit. Network intrusion detection systems (NIDS) or web application firewalls (WAF) can be configured to alert on such suspicious requests. Specific commands are not provided in the resources, but using tools like curl or wget to send crafted requests to /goform/SetIpBind with varying 'page' parameter lengths could help test for vulnerability presence. Additionally, reviewing logs for repeated or abnormal access attempts to this endpoint may help detect exploitation attempts. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing the affected Tenda WH450 device or firmware version 1.0.0.18 with a secure version if available, as no known countermeasures or patches currently exist. Restricting access to the device's management interface, especially blocking remote HTTP requests to /goform/SetIpBind, and implementing network-level protections such as firewalls or intrusion prevention systems to block exploit attempts are recommended. Monitoring for exploitation attempts and limiting authentication access can also reduce risk. [1]